[vl43den]

Description

This PR updates the backend to support pySigma 1.0.0 and adds a new Linux pipeline for converting Sigma rules targeting Linux/auditd logs.

Tested locally by converting sample Sigma rules and validating output against expected Logpoint query syntax. Based on current main (including #23 and #26, which fixes a lot of keyword based linux rules, so the only new changes are the pySigma 1.0.0 upgrade and Linux pipeline, as well as honoring the snake_case from this issue in pySigma: SigmaHQ/pySigma#309)

Changes

Dependency Updates

• Upgraded pySigma from 0.11.23 to 1.0.0
• Minimum Python version changed from 3.9 to 3.10
• Updated poetry.lock and removed Python 3.9 from the test matrix

New Features

• Added logpoint_linux_pipeline with support for:
  • Linux auditd field mappings (type, proctitle, auid, exe, etc.)
  • Generic Linux taxonomy (Image, CommandLine, ParentImage, etc.)
  • Snake_case conversion for unmapped fields

Files Changed

File	Change
pyproject.toml	Updated dependencies
poetry.lock	Regenerated
.github/workflows/test.yml	Removed Python 3.9
sigma/pipelines/logpoint/linux.py	New:Linux pipeline
sigma/pipelines/logpoint/logpoint_mapping.py	Added Linux mappings
sigma/pipelines/logpoint/init.py	Registered Linux pipeline
sigma/pipelines/logpoint/windows.py	Refactored transformations
sigma/pipelines/logpoint/azure.py	Refactored transformations
sigma/pipelines/logpoint/m365.py	Refactored transformations
tests/test_pipelines_linux.py	New: Linux pipeline tests

Breaking Changes

• Minimum Python version is now 3.10 (Python 3.9 support dropped)

[suryamajhi]

Hi @vl43den ,
Thank you for the contribution. It would be great to integrate pySigma v1.0.0 into Logpoint's backend.
However, I would like to suggest you to prepare PR with separation of concern in mind. For eg. let's only focus on upgrading pysigma version in this PR and new PR for integrating linux conversions.

[vl43den]

Hi @vl43den , Thank you for the contribution. It would be great to integrate pySigma v1.0.0 into Logpoint's backend. However, I would like to suggest you to prepare PR with separation of concern in mind. For eg. let's only focus on upgrading pysigma version in this PR and new PR for integrating linux conversions.

Thanks for the helpful feedback, it's really much better to go at it one at a time! I have divided the PR changes and created the base upgrade PR under #28, so I will close this issue and we can work on reviewing the new one easier!